This June, the Brussels Privacy Hub once again hosted the Summer Academy for Global Privacy Law, bringing together a special mix of participants and perspectives. Now in its latest edition, the Academy has firmly established itself as a platform for international dialogue on privacy, data protection, and digital governance. The 2025 edition underscored the acceleration of transformative trends and a growing sense that the boundaries between disciplines, sectors, and jurisdictions are not just shifting, but being actively redefined.

 For five days, a diverse group of technology experts and startup founders, government officials, EU institutional representatives, and legal practitioners gathered under one roof to engage in a forward-looking exchange on the state and future of the EU digital rulebook. If one message stood out—our fil rouge—it was this: cross-jurisdictional learning and collaborative enforcement are no longer optional—they’re essential.

 One of the most striking elements of this year’s Academy was the remarkable convergence among the 35 speakers invited to share their expertise and experience with the Summer Academy participants. Several themes consistently emerged:

• The GDPR’s flexibility was often acknowledged. Far from being a rigid or overly prescriptive instrument, many speakers described the GDPR as malleable enough to accommodate evolving technologies and business models, provided its foundational principles are well-understood and respected. In practice, this means a growing recognition that legal certainty does not always require legislative overhaul—interpretive guidance has a key role to play.
• Collaboration for effective enforcement was unanimously recognised as critical. Fragmentation of enforcement mechanisms—especially across sectors and among member states—risks undermining the ambitions of even the most sophisticated legal frameworks. A coordinated approach, leveraging shared intelligence and best practices, is increasingly viewed not only as desirable but as necessary. Many speakers shared a common understanding that the effectiveness of the EU model—indeed its credibility—depends on whether its mechanisms of redress and oversight are seen as timely, transparent, and coherent.
• Another thought-provoking thread concerned the focus on SMEs. While the compliance burden faced by small and medium-sized enterprises is often highlighted, this emphasis risks becoming a red herring—diverting attention from deeper structural issues or compliance gaps among more resourceful actors. The danger is that an overemphasis on SME challenges could obscure the real priority: ensuring that all actors are held accountable, thereby creating a level playing field on which the industry can develop and mature. This, in turn, is essential for building a sustainable digital ecosystem for the next generation.
• Interestingly, there was also concern that certain areas of the EU digital framework remain underexplored, particularly the Data Governance Act (DGA). In addition, while new chapters of the EU digital rulebook can appear on paper extremely ambitious, e.g., the Health Data Space Regulation, road mapping and prototyping appear to be essential to assess the new potential.
• The 2025 Summer Academy confirmed that the global privacy landscape is in flux—politically, conceptually, and technologically. It is also increasingly multipolar and multilayered. It is essential not to be misled by familiar legal language, which—though it may sound the same—can conceal vastly different realities. At the same time, we must be cautious about assuming that the first mover had the clearest vision.

As the Academy came to a close, one thing was clear: the future of privacy and data protection law will not be shaped in isolation, but through sustained, critical, and inclusive dialogue—an increasingly difficult task in today’s climate of geopolitical tension. The Brussels Privacy Hub remains committed to fostering spaces for meaningful exchange: where global perspectives engage with EU developments, where legal principles meet practical realities, and where collaboration forms the foundation of credible and resilient governance.